Apparatus and method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment.

Abstract

The present invention provides a device and method for selectively blocking network connections that use the QUIC protocol in a packet mirroring-based network environment. [Solution] The device includes a QUIC protocol detection unit that detects packets corresponding to the QUIC (Quick UDP Internet Connection) protocol among multiple packets received, a QUIC protocol analysis unit that analyzes the initial packet of the detected QUIC protocol-corresponding packet to grasp server name information, a blocking target suitability determination unit that determines whether or not to block based on the grasped server name information, and a connection blocking packet generation unit that, if determined to be a blocking target, generates and transmits a QUIC protocol connection blocking (CONNECTION_CLOSE) packet to the client and / or server.

Description

Technical Field

[0001] The present invention relates to an apparatus and method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure. More specifically, among a plurality of received packets, when an initial packet of a packet corresponding to the detected QUIC protocol is analyzed and determined to be a blocking target, a connection blocking packet of the QUIC protocol is generated and transmitted to the client and the server, respectively, to terminate the network connection. The present invention relates to an apparatus and method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure.

Background Art

[0002] Products that restrict Internet connections to some websites are used for security and other reasons.

[0003] For example, an ISP in the Republic of Korea monitors the international Internet network and prevents connections to websites requested to be blocked by the government.

[0004] In this way, the blocking method when monitoring and blocking network traffic can be divided into an inline method and a mirroring method.

[0005] The inline method is a method in which equipment for blocking determines whether to block after receiving a packet, discards the blocking target packet, and allows only the allowed packets to pass through.

[0006] The mirroring method does not allow for selective packet passage because the blocking equipment only receives mirrored packets and does not enter the actual network line. However, it does terminate the network connection (e.g., TCP connection) by generating additional control packets to terminate the connection. This type of mirroring method has the advantage that, because the blocking equipment does not operate inline, a malfunction of the equipment does not affect the transmission of network traffic.

[0007] Furthermore, blocking existing mirroring methods is implemented by using the rst or fin flags of the TCP protocol. However, since HTTP / 3 uses the UDP-based QUIC protocol instead of TCP, there is a problem in that methods that control the TCP protocol can no longer terminate the desired network connection. [Prior art documents] [Patent Documents]

[0008] [Patent Document 1] Korean Published Patent No. 2024-0175294 "Network Monitoring Method for Packet Mirroring Infrastructure" [Overview of the project] [Problems that the invention aims to solve]

[0009] The object of the present invention is to provide a device and method for selectively blocking connections of networks using the QUIC protocol in a packet mirroring infrastructure network environment, which analyzes the initial packets of packets corresponding to the detected QUIC protocol from among multiple received packets to obtain server name information, and determines whether or not to block based on the obtained server name information.

[0010] Another object of the present invention is to provide a device and method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment, which, when determined to be subject to blocking, generates and transmits QUIC protocol connection blocking packets to the client and server, respectively, to terminate the network connection. [Means for solving the problem]

[0011] All of the aforementioned and other objectives of the present invention can be achieved by the apparatus and method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment according to the present invention.

[0012] A device for selectively blocking network connections using the QUIC protocol in a packet mirroring infrastructure network environment according to one embodiment of the present invention includes a QUIC protocol detection unit that detects packets corresponding to the QUIC (Quick UDP Internet Connection) protocol among a plurality of received packets, a QUIC protocol analysis unit that analyzes the initial packet of the detected QUIC protocol-corresponding packet to grasp server name information, a blocking target suitability determination unit that determines whether or not to block based on the grasped server name information, and a connection blocking packet generation unit that, if determined to be a blocking target, generates and transmits a QUIC protocol connection blocking (CONNECTION_CLOSE) packet to the client and / or server.

[0013] Furthermore, the QUIC protocol detection unit is characterized in that, if the initial packet, which is the start packet of the QUIC protocol, can be analyzed using a pre-proposed internet standard method, it detects that packet and subsequent packets as packets corresponding to the QUIC protocol.

[0014] Furthermore, the QUIC protocol analysis unit is characterized by analyzing the initial packet to collect the connection attempt message (Client-Hello) sent by the client to the server and determining the server name information.

[0015] Furthermore, the QUIC protocol analysis unit is characterized by deriving the initial secret value of the initial packet from the Destination Connection ID (DCID) value of the first packet sent by the client to the server and a predefined salt value, decrypting the connection attempt message sent by the client, and then analyzing the decrypted connection attempt message to grasp the server name information of the server that the client is trying to connect to.

[0016] Furthermore, the connection termination packet generation unit generates a connection termination packet that includes an IP header or IPv6 header containing the destination IP address which is the source IP address of the initial packet and the source IP address which is the destination IP address of the initial packet, a UDP header containing the destination port number which is the source port number of the initial packet and the source port number which is the destination port number of the initial packet, a QUIC header and a QUIC payload containing the frame type, and then transmits it to the client to terminate the network connection.

[0017] In this case, the QUIC header is characterized by setting the header form, fixed bit value, long packet type, reserved bits, packet number length, initial packet version number, destination concatenation identifier length, source connection ID (SCID) length, source connection identifier, token length, and packet number.

[0018] Furthermore, the connection termination packet generation unit generates a connection termination packet that includes an IP header or IPv6 header containing the destination IP address, which is the destination IP address of the initial packet, and the source IP address, which is the source IP address of the initial packet, a UDP header containing the destination port number, which is the destination port number of the initial packet, and the source port number, which is the source port number of the initial packet, a QUIC header, and a QUIC payload containing the frame type, in order to ensure that the connection termination packet sent to the server is determined to be a packet sent by the client, and then transmits it to the server to terminate the network connection.

[0019] In this case, the QUIC header is characterized by setting the header type, fixed bit value, long packet type, reserved bits, packet number length, initial packet version number, destination concatenation identifier length, destination concatenation identifier value, source concatenation identifier length, token length, and packet number respectively, setting the long packet type to 0 to send the concatenation-blocking packet as the initial packet, and setting the packet number to the packet number of the most recently arrived initial packet plus 1 so that it is recognized by the server as a series of packets sent by the client.

[0020] A method for selectively blocking network connections using the QUIC protocol in a packet mirroring infrastructure network environment according to one embodiment of the present invention includes the steps of: a QUIC protocol detection unit detecting packets corresponding to the QUIC (Quick UDP Internet Connection) protocol from among multiple received packets; a QUIC protocol analysis unit analyzing the initial packets of the detected QUIC protocol packets to obtain server name information; a blocking target suitability determination unit determining whether or not the obtained server name information is a target for blocking; and a connection blocking packet generation unit, if it is determined that the connection is a target for blocking, generating and transmitting QUIC protocol connection blocking (CONNECTION_CLOSE) packets to the client and / or server. [Effects of the Invention]

[0021] The present invention provides a device and method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment. This device analyzes the initial packet of a packet corresponding to the detected QUIC protocol from among multiple received packets to obtain server name information, determines whether or not it is a target for blocking based on the obtained server name information, and if it is determined to be a target for blocking, generates and transmits a QUIC protocol connection blocking packet to the client and / or server, thereby selectively terminating the desired network connection. [Brief explanation of the drawing]

[0022] [Figure 1] This diagram illustrates the configuration of a system to which a device that selectively blocks network connections using the QUIC protocol in a packet mirroring-based network environment according to the present invention is applied. [Figure 2]This is a diagram for explaining the configuration of an apparatus that selectively blocks the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure according to the present invention. [Figure 3] This is a flowchart for explaining the procedure of a method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure according to the present invention. [Figure 4] This is a flowchart for explaining the communication procedure in a method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure according to the present invention.

Embodiments for Carrying out the Invention

[0023] Hereinafter, referring to the accompanying drawings, an apparatus and a method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure according to the present invention will be described in detail. [[ID=...]] [[ID=...]]

[0024] [[ID=...]] In the following description, only the parts necessary for understanding an apparatus and a method for selectively blocking the connection of a network using the QUIC protocol in a network environment of a packet mirroring infrastructure according to an embodiment of the present invention will be described, and the description of other parts may be omitted so as not to obscure the gist of the present invention.

[0025] Also, terms or words used in the present specification and claims described below should not be construed as being limited to their ordinary or dictionary meanings, but should be construed in accordance with the meanings and concepts that conform to the technical idea of the present invention so as to most appropriately represent the present invention. "

[0026] Throughout the specification, when a part "includes" a component, this does not exclude other components unless otherwise stated, but rather means that it may include other components. Furthermore, terms such as "...part," "...machine," and "module" used in the specification refer to a unit that processes at least one function or operation, which can be embodied in hardware, software, or a combination of hardware and software.

[0027] In various embodiments, components having the same configuration will be described representatively in one embodiment using the same reference numerals, while in other embodiments, configurations different from those in one embodiment will be described.

[0028] Figure 1 is a diagram illustrating the configuration of a system to which a device that selectively blocks connections of networks using the QUIC protocol in a packet mirroring infrastructure network environment according to the present invention is applied, and Figure 2 is a diagram illustrating the configuration of a device that selectively blocks connections of networks using the QUIC protocol in a packet mirroring infrastructure network environment according to the present invention.

[0029] Referring to Figures 1 and 2, the device 100 for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment according to the present invention is located between the client 10 and the server 20. It analyzes the initial packet of the detected QUIC protocol packet to obtain server name information, determines whether or not it is a packet to be blocked based on the obtained server name information, and if it is a packet to be blocked, it generates a connection blocking packet to the server that causes the server to determine that it was sent by the client, and generates a connection blocking packet to the client that causes the client to determine that it was sent by the server. When these two packets are transmitted to the server and the client respectively, the server and the client are caused to terminate their connections. At this time, it is also possible to transmit the connection blocking packet to only one of the server or the client to terminate the connection.

[0030] The configuration of the device 100 for selectively blocking connections of networks using the QUIC protocol in the network environment of the packet mirroring infrastructure according to the present invention is as follows.

[0031] A device (100, hereinafter referred to as "this device") that selectively blocks network connections using the QUIC protocol in a packet mirroring-based network environment may broadly include a QUIC protocol detection unit 110, a QUIC protocol analysis unit 120, a blockage target suitability determination unit 130, and a connection blocking packet generation unit 140.

[0032] The QUIC protocol detection unit 110 detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol from among multiple packets received.

[0033] The QUIC protocol detection unit 110 can detect that the initial packet, which is the start packet of the QUIC protocol sent by the client to the server, is a packet corresponding to the QUIC protocol if it can be analyzed using a pre-proposed internet standard method. In this case, the pre-proposed internet standard method is RFC9001.

[0034] The QUIC protocol analysis unit 120 analyzes the initial packets of the detected QUIC protocol packets to obtain server name information.

[0035] The QUIC protocol analysis unit 120 analyzes the initial packet to collect the connection attempt message (Client-Hello) sent by the client to the server and can determine the server name information.

[0036] More specifically, the initial packet of a packet corresponding to the QUIC protocol undergoes a packet protection process. Therefore, the QUIC protocol analysis unit 120 derives the initial secret value of the initial packet from the Destination Connection ID (DCID) value of the first packet sent by the client to the server and a predefined salt value (see RFC9001 5.2. Initial Secrets). After decrypting the connection attempt message sent by the client, the analysis unit can determine the server name information of the server that the client is trying to connect to by analyzing the decrypted connection attempt message.

[0037] Here, the methods for using RFC9001 5.2. Initial Secrets can be broadly divided into methods for generating initial secrets, methods for using initial secrets, initial key discarding, and initial packet protection.

[0038] The initial secret is used to create the client_initial_secret and server_initial_secret. The client extracts the public key (pkR), uses the pkR to generate the shared secret, and then uses the shared secret to generate the initial secret.

[0039] Therefore, the way initial secrets are used is that initial_secret is used to generate client_initial_secret and server_initial_secret, and initial secret is used to protect the QUIC initial packet.

[0040] Then, in the initial key discard process, the client removes the initial key when sending the handshake packet, and the server discards the initial key after successfully processing the handshake packet.

[0041] In initial packet protection, the initial packet protection key is discarded more aggressively than other keys, which is intended to limit attacks that could allow an attacker to spoof packets and disrupt linkages.

[0042] The blocking target suitability determination unit 130 determines whether or not a server should be blocked based on the acquired server name information. The blocking target suitability determination unit 130 can determine whether a server should be blocked by comparing it with the acquired server name information, which can be stored in advance.

[0043] When the connection blocking packet generation unit 140 determines that a connection should be blocked, it generates and transmits a QUIC protocol connection blocking (CONNECTION_CLOSE) packet to the client and / or server. The initial packet described below is the most recently arrived initial packet from the initial packets sent by the client to the server to this device 100.

[0044] First, the connection-breaking packet generation unit 140 generates a connection-breaking packet so that the connection-breaking packet sent to the client is determined to be a packet sent by the server. This packet consists of an IP header or IPv6 header containing the destination IP address which is the source IP address of the initial packet, a UDP header containing the destination port number which is the source port number of the initial packet, a QUIC header, and a QUIC payload containing the frame type. The unit then transmits the packet to the client to terminate the network connection.

[0045] Here, the QUIC header is configured as follows: Header Form, Fixed Bit, Long Packet Type, Reserved Bits, Packet Number Length, Initial Packet Version Number, Destination Concatenation Identifier Length, Source Concatenation Identifier (SCID: Source Connection ID) Length, Source Concatenation Identifier, Token Length, and Packet Number.

[0046] IP header or IPv6 header - Destination IP address: The IP address of the source of the initial packet. - Origin IP address: Destination IP address of the initial packet UDP header -Destination port number: The source port number of the initial packet. - Origin port number: Destination port number of the initial packet QUICHeader -Header Form:1 -Fixed Bit:1 -Long Packet Type:0 -Reserved Bits:0 -Packet Number Length: Set to match the Packet Number value. -Version: Version number of the initial packet -DCID Len:0 -SCID Len: Any value from 1 to 20 -Source Connection ID: Any value -Token Length:0 -Packet Number: Any value QUIC Payload -Frame Type:CONNECTION_CLOSE In this case, the Long Packet Type of the concatenation block packet is set to 0 (initial packet). This means that the concatenation block packet will be sent as an initial packet.

[0047] The packet number can be set to any value. This is because the coupling interruption packet sent by device 100 is the first packet received by the client, and therefore device 100 can arbitrarily set the value of the first packet.

[0048] For the same reason, the Source Connection ID value is generated and used by the device 100.

[0049] When a connection-breaking packet generated in this way is transmitted to the client, the client interprets this packet as having been transmitted from the server, and since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), it terminates the connection.

[0050] The connection-blocking packet generation unit 140 then generates a connection-blocking packet that includes an IP header or IPv6 header containing the destination IP address (which is the destination IP address of the initial packet) and the source IP address (which is the source IP address of the initial packet), a UDP header containing the destination port number (which is the destination port number of the initial packet) and the source port number (which is the source port number of the initial packet), a QUIC header, and a QUIC payload containing the frame type, in order to ensure that the connection-blocking packet sent to the server is determined to be a packet sent by the client. The unit then transmits the packet to the server to terminate the network connection.

[0051] Here, the QUIC header sets the header type, fixed bit values, long packet type, reserved bits, packet number length, initial packet version number (Version), destination concatenation identifier length, destination concatenation identifier value, source concatenation identifier length, token length, and packet number as follows:

[0052] IP header or IPv6 header - Destination IP address: The destination IP address of the initial packet. - Origin IP address: The origin IP address of the initial packet. UDP header - Destination port number: Destination port number of the initial packet - Origin port number: The origin port number of the initial packet. QUICHeader -Header Form:1 -Fixed Bit:1 -Long Packet Type:0 -Reserved Bits:0 -Packet Number Length: Set to match the Packet Number value. -Version: Version number of the initial packet -DCID Len: Initial packet DCID Len value -Destination Connection ID: Initial packet Destination Connection ID value -SCID Less:0 -Token Length:0 -Packet Number: Initial packet's Packet Number + 1 QUIC Payload -Frame Type:CONNECTION_CLOSE In this case, the Long Packet Type of the concatenation block packet is set to 0 (initial packet). This means that the concatenation block packet will be sent as an initial packet.

[0053] The packet number is set to the packet number of the most recently arrived initial packet + 1. This is to allow the receiving server to recognize it as part of a continuous packet sequence sent by the client.

[0054] When a connection-blocking packet generated in this way is transmitted to the server, the server interprets this packet as having been sent from the client and, since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), terminates the network connection.

[0055] As described above, when a connection termination packet (a connection termination packet transmitted to the client, a connection termination packet transmitted to the server) is transmitted to either the server or the client, the server and / or client that receives the packet will terminate the network connection.

[0056] Figure 3 is a flowchart illustrating the procedure for selectively blocking network connections using the QUIC protocol in a packet mirroring infrastructure network environment according to the present invention.

[0057] Referring to Figure 3, the method for selectively blocking connections of networks using the QUIC protocol in the network environment of the packet mirroring infrastructure according to the present invention uses the device described above for selectively blocking connections of networks using the QUIC protocol in the network environment of the packet mirroring infrastructure according to the present invention, and any further redundant explanations will be omitted.

[0058] First, among the multiple packets received, the system detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol (S100).

[0059] In the S100 stage, if the initial packet, which is the start packet of the QUIC protocol sent by the client to the server, can be analyzed using a pre-proposed internet standard, then that packet and subsequent packets can be detected as packets corresponding to the QUIC protocol. In this case, the pre-proposed internet standard is RFC9001.

[0060] Next, the initial packets of the detected QUIC protocol are analyzed to obtain server name information (S110).

[0061] The S110 stage analyzes the initial packet to collect the connection attempt message (Client-Hello) sent by the client to the server and obtain server name information. More specifically, the initial secret value of the initial packet is derived from the Destination Connection ID (DCID) value of the first packet sent by the client to the server and a predefined salt value (see RFC9001 5.2. Initial Secrets). After decrypting the connection attempt message sent by the client, the decrypted connection attempt message is analyzed to obtain the server name information of the server that the client is trying to connect to.

[0062] Next, it is determined whether or not the server should be blocked based on the acquired server name information (S120).

[0063] The S120 stage can determine which servers to block by pre-saving information about servers to be blocked and comparing it with known server name information.

[0064] Next, if it is determined at stage S120 that the connection should be blocked, a QUIC protocol connection blocking (CONNECTION_CLOSE) packet is generated and transmitted to the client and / or server (S130, S140).

[0065] The S130 stage generates and transmits a connection termination packet to send to the client. At this time, in order for the connection termination packet to be recognized as a packet sent by the server, the connection termination packet is generated and consists of an IP header or IPv6 header containing the destination IP address which is the source IP address of the initial packet and the source IP address which is the destination IP address of the initial packet, a UDP header containing the destination port number which is the source port number of the initial packet and the source port number which is the destination port number of the initial packet, a QUIC header, and a QUIC payload containing the frame type. This packet is then transmitted to the client to terminate the network connection.

[0066] When a connection-blocking packet generated in this way is transmitted to the client, the client interprets this packet as having been transmitted from the server, and since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), it terminates the connection.

[0067] The S140 stage generates and transmits a connection termination packet to be sent to the server. At this time, in order for the connection termination packet to be recognized as a packet sent by the client, the connection termination packet is generated and consists of an IP header or IPv6 header containing the destination IP address (the destination IP address of the initial packet) and the source IP address (the source IP address of the initial packet), a UDP header containing the destination port number (the destination port number of the initial packet) and the source port number (the source port number of the initial packet), a QUIC header, and a QUIC payload containing the frame type. This packet is then transmitted to the server to terminate the network connection.

[0068] When a connection-blocking packet generated in this way is transmitted to the server, the server interprets this packet as having been sent from the client and, since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), terminates the network connection.

[0069] As described above, when the two connection termination packets (the connection termination packet transmitted to the client and the connection termination packet transmitted to the server) are transmitted to the server and the client respectively, the server and the client will terminate their connection.

[0070] Figure 3 shows the transmission of a connection termination packet to both the server and the client, but it is also possible to terminate the network connection by transmitting the connection termination packet to only one of the servers or the client.

[0071] On the other hand, if it is determined at the S120 stage that the connection between the server and the client is not to be blocked, the connection between the server and the client will not be blocked.

[0072] Figure 4 is a flowchart illustrating the communication procedure in a method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment according to the present invention.

[0073] Referring to Figure 4, first, client 10 transmits a connection request packet (connection attempt message) to server 20 (S200).

[0074] Next, the device 100 detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol from among the multiple packets received (S210).

[0075] In the S210 stage, if the initial packet, which is the start packet of the QUIC protocol sent by client 10 to server 20, can be analyzed using a pre-proposed internet standard method, then it can be detected that the packet and subsequent packets are packets corresponding to the QUIC protocol.

[0076] Next, the device 100 analyzes the initial packet of the detected QUIC protocol to obtain server name information (S220).

[0077] The S220 stage analyzes the initial packet to collect the connection attempt message (Client-Hello) sent by client 10 to server 20 and obtain server name information. The initial secret value of the initial packet is derived from the Destination Connection ID (DCID) value of the first packet sent by client 10 to server 20 and a predefined salt value (see RFC9001 5.2. Initial Secrets). After decrypting the connection attempt message sent by client 10, the decrypted connection attempt message is analyzed to obtain the server name information of the server that the client is trying to connect to.

[0078] Next, the device 100 determines whether or not a server should be blocked based on the acquired server name information.

[0079] Next, if the device 100 determines that a connection is to be blocked, it generates QUIC protocol connection blocking (CONNECTION_CLOSE) packets for both the client 10 and the server 20 (S240).

[0080] At the S240 stage, the device 100 generates a concatenation block packet that includes an IP header or IPv6 header containing the destination IP address which is the source IP address of the initial packet and the source IP address which is the destination IP address of the initial packet, a UDP header containing the destination port number which is the source port number of the initial packet and the source port number which is the destination port number of the initial packet, a QUIC header, and a QUIC payload containing the frame type, so that the concatenation block packet sent to the client 10 is determined to be a packet sent by the server.

[0081] Here, the QUIC header sets the Header Form, Fixed Bit, Long Packet Type, Reserved Bits, Packet Number Length, Initial Packet Version Number, Destination Connection Identifier Length, Source Connection Identifier (SCID) Length, Source Connection Identifier, Token Length, and Packet Number. This means that the connection-breaking packet is sent as the initial packet. The Packet Number can be set to any value. This is because the connection-breaking packet sent by device 100 is the first packet received by the client, and therefore device 100 can arbitrarily set the initial packet number value. For the same reason, device 100 generates and uses an arbitrary value for the Source Connection Identifier.

[0082] Next, the link-blocking packet generated in step S240 is transmitted to client 10 (S250).

[0083] Next, client 10 interprets this packet as having been transmitted from server 20, and since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), it terminates the connection (S270).

[0084] At the S240 stage, the device 100 generates a concatenation block packet that includes an IP header or IPv6 header containing the destination IP address (which is the destination IP address of the initial packet) and the source IP address (which is the source IP address of the initial packet), a UDP header containing the destination port number (which is the destination port number of the initial packet) and the source port number (which is the source port number of the initial packet), a QUIC header, and a QUIC payload containing the frame type, so that the concatenation block packet sent to the server 20 is determined to be a packet sent by the client.

[0085] Here, the QUIC header sets the header type, fixed bit values, long packet type, reserved bits, packet number length, initial packet version number, destination concatenation identifier length, destination concatenation identifier value, source concatenation identifier length, token length, and packet number. At this time, the long packet type of the concatenation-blocking packet is set to 0 (initial packet). The packet number is set to the packet number of the most recently arrived initial packet + 1. This is so that the server 20 receiving this packet recognizes it as a continuous packet sent by the client 10.

[0086] Next, the link-blocking packet generated in step S240 is transmitted to server 20 (S260).

[0087] Next, the server 20 interprets this packet as having been transmitted from the client 10, and since the analysis result is CONNECTION_CLOSE (0x1C or 0x1D), it terminates the network connection (S270).

[0088] Figure 4 shows the transmission of a connection termination packet to both the server and the client, but it is also possible to terminate the network connection by transmitting the connection termination packet to only one of the servers or the client.

[0089] The functional operations and embodiments relating to the subject matter described herein can be embodied by a combination of digital electronic circuits, computer software, firmware, or hardware, or one or more thereof, including the structures disclosed herein and their structural equivalents.

[0090] Embodiments of the subject matter described herein may be one or more of a module relating to computer program instructions encoded on a type of program medium for execution by or control of a computer program product, i.e., a data processing device. The type of program medium may be an electromagnetic signal or a computer-readable medium. An electromagnetic signal is an artificially generated signal, such as a machine-generated electrical, optical, or electromagnetic signal, produced for encoding information to be transmitted to a suitable receiver for execution by a computer. A computer-readable medium may be a machine-readable storage device, a machine-readable storage substrate, a memory device, a combination of materials that affect machine-readable electromagnetic signals, or a combination of one or more of these.

[0091] Computer programs (also known as programs, software, software applications, scripts, or code) can be written in any form of a programming language, including compiled or interpreted languages ​​or a priori or procedural languages, and can be developed into any form, including standalone programs or modules, components, subroutines, or other units suitable for use in a computer environment.

[0092] Computer programs do not necessarily correspond to files in a file device. A program can be stored in a single file provided to the requested program, in multiple interacting files (e.g., one or more files storing modules, subprograms, or parts of code), or in parts of files that hold other programs or data (e.g., one or more scripts stored within a markup language document).

[0093] Computer programs can be deployed to run on multiple computers located at a single site, or on a single computer distributed across multiple sites and interconnected by a communication network.

[0094] Additionally, the logical flow and structural block diagrams described in this patent document can also be used to define corresponding software structures, algorithms, and their equivalents by describing corresponding actions and / or specific methods supported by corresponding functions and stages supported by the disclosed structural means.

[0095] The processes and logical flows described herein can be performed by one or more programmable processors, one or more of which execute computer programs, in order to perform their functions by operating on received data and generating output.

[0096] Processors suitable for executing computer programs include, for example, one or more general-purpose and special-purpose microprocessors and any form of digital computer as processors. Generally, a processor receives instructions and data from read-only memory, random-access memory, or both.

[0097] The core elements of a computer are one or more memory devices for storing instructions and data, and a processor for executing those instructions. A computer also generally includes, or is coupled to, one or more mass storage devices for storing data, such as magnetic, magneto-optical disks, or optical disks, to receive data from or transmit data to them, or to perform both of these operations. However, a computer does not necessarily need to have such devices.

[0098] This specification presents the best modes of the invention and provides examples to illustrate the invention and to enable those skilled in the art to construct and utilize it. This specification, thus prepared, does not limit the invention to the specific terms presented herein.

[0099] Therefore, although the present invention has been described in detail with reference to the examples above, those skilled in the art can modify, change, and alter these examples without departing from the scope of the present invention. In other words, it should be noted that in order to achieve the effects intended by the present invention, it is not necessary to separately include all the functional blocks shown in the drawings or to perform all the procedures shown in the drawings exactly as shown; even if not, the invention can still fall within the technical scope of the claims. [Explanation of Symbols]

[0100] 100: A device that selectively blocks network connections using the QUIC protocol in a packet mirroring-based network environment. 110: QUIC protocol detection unit 120: QUIC Protocol Analysis Department 130: Blocking Target Suitability Determination Unit 140: Link Blocking Packet Generation Unit

Claims

1. A QUIC protocol detection unit detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol among multiple packets received. The QUIC protocol analysis unit analyzes the initial packets of detected QUIC protocol packets to obtain server name information. A blocking target suitability determination unit that determines whether or not a server should be blocked based on the acquired server name information, and A device for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment, characterized by including a connection-closing packet generation unit that generates and transmits QUIC protocol connection-closing (CONNECTION_CLOSE) packets to the client and server respectively when it is determined that the connection is subject to blocking.

2. A QUIC protocol detection unit detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol among multiple packets received. The QUIC protocol analysis unit analyzes the initial packets of detected QUIC protocol packets to obtain server name information. A blocking target suitability determination unit that determines whether or not a server should be blocked based on the acquired server name information, and A device for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment, characterized by including a connection-closing packet generation unit that generates and transmits a QUIC protocol connection-closing (CONNECTION_CLOSE) packet to the client when it is determined that the connection is subject to blocking.

3. A QUIC protocol detection unit detects packets that correspond to the QUIC (Quick UDP Internet Connection) protocol among multiple packets received. The QUIC protocol analysis unit analyzes the initial packets of detected QUIC protocol packets to obtain server name information. A blocking target suitability determination unit that determines whether or not a server should be blocked based on the acquired server name information, and A device for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment, characterized by including a connection-closing packet generation unit that generates and transmits a QUIC protocol connection-closing (CONNECTION_CLOSE) packet to a server when it is determined that the connection is subject to blocking.

4. The device for selectively blocking connections to networks using the QUIC protocol in a network environment of a packet mirroring infrastructure according to any one of claims 1 to 3, characterized in that the QUIC protocol detection unit detects that the initial packet, which is the initiation packet of the QUIC protocol, can be analyzed using a pre-proposed internet standard method, and that the packet and subsequent packets are packets corresponding to the QUIC protocol.

5. The device selectively blocks network connections using the QUIC protocol in a packet mirroring infrastructure network environment according to any one of claims 1 to 3, characterized in that the QUIC protocol analysis unit analyzes initial packets, collects connection attempt messages (Client-Hello) sent by clients to servers, and grasps server name information.

6. The device selectively blocks network connections using the QUIC protocol in a packet mirroring infrastructure network environment according to claim 5, characterized in that the QUIC protocol analysis unit derives the initial secret value of the initial packet from the Destination Connection ID (DCID) value of the first packet sent by the client to the server and a predefined salt value, decodes the connection attempt message sent by the client, and then analyzes the decoded connection attempt message to grasp the server name information of the server that the client is trying to connect to.

7. The connection-blocking packet generation unit generates a connection-blocking packet in a network environment of a packet mirroring infrastructure according to claim 1 or 2, which is characterized by generating a connection-blocking packet consisting of an IP header or IPv6 header including the destination IP address which is the source IP address of the initial packet and the source IP address which is the destination IP address of the initial packet, a UDP header including the destination port number which is the source port number of the initial packet and the source port number which is the destination port number of the initial packet, a QUIC header and a QUIC payload including the frame type, and then transmitting it to the client to terminate the network connection.

8. The QUIC header is characterized by setting the header format, fixed bit value, long packet type, reserved bits, packet number length, initial packet version number, destination concatenation identifier length, source concatenation identifier (SCID) length, source concatenation identifier, token length, and packet number, respectively, and is a device for selectively blocking network connections using the QUIC protocol in a network environment of a packet mirroring infrastructure according to claim 7.

9. The connection-blocking packet generation unit generates a connection-blocking packet in a packet mirroring infrastructure network environment according to claim 1 or 3, characterized in that it generates a connection-blocking packet consisting of an IP header or IPv6 header including a destination IP address which is the destination IP address of the initial packet and a source IP address which is the source IP address of the initial packet, a UDP header including a destination port number which is the destination port number of the initial packet and a source port number which is the source port number of the initial packet, a QUIC header and a QUIC payload including a frame type, and then transmits it to the server to terminate the network connection.

10. The QUIC header is configured with header type, fixed bit value, long packet type, reserved bits, packet number length, initial packet version number (Version), destination concatenation identifier length, destination concatenation identifier value, source concatenation identifier length, token length, and packet number, respectively. The long packet type is set to 0 to send the concatenation-blocking packet as the initial packet, and the packet number is set to the packet number of the most recently arrived initial packet plus 1 so that the server recognizes it as a series of packets sent by the client. This is a device for selectively blocking network connections using the QUIC protocol in a network environment of a packet mirroring infrastructure as described in 9.

11. In the QUIC protocol detection unit, among the multiple packets received, packets corresponding to the QUIC (Quick UDP Internet Connection) protocol are detected. The QUIC protocol analysis unit analyzes the initial packets of the detected QUIC protocol packets to obtain server name information. The blocking target suitability determination unit determines whether or not the server should be blocked based on the obtained server name information, and A method for selectively blocking network connections using the QUIC protocol in a packet mirroring-based network environment, characterized by including a step in which a connection blocking packet generation unit determines that a connection should be blocked, generates and transmits a QUIC protocol connection blocking (CONNECTION_CLOSE) packet to the client and / or server.

Images